JSTests/microbenchmarks/string-get-by-val-out-of-bounds-insane.js

   1 function foo(string) {
   2     var result = ["", ""];
   3     for (var i = 0; i < 100000; ++i)
   4         result[i & 1] = string[i & 1];
   5     return result;
   6 }
   7
   8 Object.prototype[1] = 42;
   9
  10 var result = foo("x");
  11 if (result[0] != "x")
  12     throw "Bad result[0]: " + result[0];
  13 if (result[1] != 42)
  14     throw "Bad result[1]: " + result[1];